To Default Reject Or Block That is the Question.
-
Hello fellow Netgate Community members,
I wanted to share this with you incase you ever asked the question what the difference its between block or reject...
This is a result of a default block all on WAN interface
Versus Reject....
If set to reject ....
EPIC FAIL!!!!
Why it matters because it provides a response thus it's not stealthy.
Ref: https://www.grc.com/
Make sure to upvote
-
@JonathanLee said in To Default Reject Or Block That is the Question.:
Why it matters because it provides a response thus it's not stealthy.
I think that is normal: when a rule blocks, the packets are silently discarded but when reject the other part gets an answer that the request was rejected IMHO. But in both cases the firewall is closed.
-
@JonathanLee said in To Default Reject Or Block That is the Question.:
Why it matters because it provides a response thus it's not stealthy.
The problem is not that its not "stealthy" - the problem is you would be sending a reject for all the noise hitting your wan.. Reject on a wan interface is almost never a good idea. The only time it makes sense is if you want a reject sent - say to allow traceroute answer from that hop or something.. Why would you want to make your firewall work harder, and use bandwidth to send rejects to noise?
Also placing a block on your wan, unless with use of other rules, or wanting to specific log or not log something seems a bit pointless - since the default deny will drop any traffic that not specifically allowed anyway.
-
@johnpoz said in To Default Reject Or Block That is the Question.:
Reject on a wan interface is almost never a good idea.
That is correct.
-
@JonathanLee said in To Default Reject Or Block That is the Question.:
I wanted to share this with you incase you ever asked the question what the difference its between block or reject...
A block just drops the packet, without any other response. A reject sends an ICMP message back advising why. You want to use block on the WAN, so that the attacker has no confirmation there's something there. Use reject on the LAN, so that an issue can be identified.
